1. Purpose, Scope and Data Controller
As Bando Creative Studio Reklam A.Ş. (TIN: 1400578014) (“Ba’ndo” or the “Company”), having its registered office at Suadiye Mah. Noter Sok. No:11-13 Floor:2 Apt:3 Kadıköy / Istanbul, we exercise the utmost care with respect to the security of your personal data. With this awareness, we attach great importance to processing and retaining the personal data of the natural persons with whom we interact in accordance with Personal Data Protection Law No. 6698 (the “Law” or the “PDPL”), the secondary legislation enacted under the Law (including regulations and communiqués), and the binding decisions of the Personal Data Protection Board.
In full recognition of this responsibility, we process your personal data in our capacity as the Data Controller as described below and within the limits prescribed by applicable legislation, while implementing all necessary technical and administrative measures to ensure an appropriate level of security, prevent the unlawful processing of and access to personal data, and safeguard personal data.
This General Privacy Notice has been prepared pursuant to Article 10 of the PDPL to inform you about the personal data processed when you visit our website at www.wearebando.com (the “Site”) or contact us through the general communication channels published on the Site.
This Notice provides a general framework and is intended primarily to ensure full compliance with the principle of transparency. If you become involved in a specific process, such as a job application, business development or proposal, contracting, customer or supplier relationship, a process-specific privacy notice will also be provided at the point at which your personal data is collected.
2. Personal Data Processed, Purposes and Legal Bases
Your personal data is processed lawfully, fairly, accurately and, where necessary, kept up to date; for specified, explicit and legitimate purposes; and in a manner that is relevant, limited and proportionate to those purposes.
Your personal data is collected by Ba’ndo from information that you provide directly, orally, in writing or electronically, and through the Site and other applications and software used within the scope of the Company’s activities. It is processed by fully or partially automated means or by non-automated means, provided that the processing forms part of a data filing system.
The principal processing activities carried out through the Site and the general communication channels are set out below.
| Process | Personal Data | Purposes of Processing | Legal Basis |
|---|---|---|---|
| Website and Information Security | IP address; date and time of access; requested page/URL; device, operating system and browser information; error, incident and security logs | providing the Site and its content; ensuring performance and usability; maintaining system, network and information security; preventing unauthorised access and misuse; investigating errors and incidents | Article 5(2)(f) of the PDPL: Ba’ndo’s legitimate interest in securely operating the Site, provided that this does not prejudice your fundamental rights and freedoms. Where a specific record is expressly required by law, Article 5(2)(a), and/or where necessary for compliance with a legal obligation, Article 5(2)(ç). |
| Essential Cookies and Preferences | cookie/session identifier, cookie preference, date of preference and technical records | providing the Site functions that you expressly request; ensuring security and session continuity; recording your cookie preferences | Article 5(2)(c) and/or Article 5(2)(f) of the PDPL, depending on the function of the relevant cookie. Further details are provided in the Cookie Notice and Privacy Policy. |
| General Enquiries | name and surname; e-mail address and, where provided, telephone number; message and request/complaint content; job and company information; e-mail signature and attachments provided by you | receiving, classifying and responding to communications and requests; directing the request to the relevant department; maintaining communication records and legal/operational security | Depending on the nature of the request: Article 5(2)(f) of the PDPL; Article 5(2)(c) where directly related to the establishment or performance of a contract; Article 5(2)(e) where necessary for the establishment, exercise or protection of a right; and Article 5(2)(ç) where necessary for compliance with a legal obligation. |
| Business Enquiry | name and surname; e-mail address/telephone number; organisation and title; project, brief, need, budget and timing information; correspondence, signature and attachments | assessing your needs; conducting preliminary discussions; carrying out proposal and pre-contractual processes; managing communication and business development records | Articles 5(2)(c) and 5(2)(f), and where necessary Article 5(2)(e), of the PDPL. Further details are provided in the Prospective Client and Business Development Privacy Notice. |
| Process | Personal Data | Purposes of Processing | Legal Basis |
|---|---|---|---|
| Careers Enquiry | name and surname; contact details; education and professional experience; CV, portfolio, references and application content | receiving the application and directing it to the relevant recruitment process; communicating with the candidate | Detailed legal bases are explained in the Candidate Privacy Notice provided when the data is collected. Articles 5(2)(f), 5(2)(c) and 5(2)(e) of the PDPL may apply. |
Please do not include in your e-mails or attachments any special categories of personal data or other sensitive information that is not necessary to assess your application or request, such as your Turkish ID number, health or disability information, religion, denomination, political opinion, membership of an association, foundation or trade union, criminal conviction data, or genetic or biometric data.
3. Methods of Collecting Personal Data
Your personal data is collected electronically through the following methods:
-
automatically, through the web server, security infrastructure, strictly necessary cookies and, to the extent permitted by you, other cookies or similar technologies when you access the Site;
-
directly from you, through the e-mails and attachments that you send to hello@wearebando.com, newbiz.ldn@wearebando.com, newbiz.ist@wearebando.com or apply@wearebando.com;
-
from third parties, such as a person whom you have authorised with your knowledge, a referee, or the organisation that you represent, in connection with business development or recruitment communications.
Where your personal data has not been obtained directly from you, the obligation to inform will be fulfilled within a reasonable period after the data is obtained, at the time of the first communication with you if the data is to be used to contact you, or no later than the first transfer if the data is to be transferred.
4. Cookies and Similar Technologies
The name, provider, purpose, type and retention period of the cookies used on the Site, whether they are first- or third-party cookies, the applicable legal basis, and how you may manage your preferences are explained in the Cookie Notice and Privacy Policy.
5. Transfer of Personal Data
To the extent required for the purposes set out above and in accordance with Articles 8 and 9 of the PDPL, your personal data may be transferred to the following recipient groups:
-
suppliers providing hosting, e-mail, information technology, cybersecurity, backup, technical support and similar services, solely for the purpose of providing the relevant service and securely operating the systems;
-
consultants, lawyers, auditors and insurance companies, for the purposes of complying with legal obligations, conducting audits, and establishing, exercising or protecting a right;
-
business partners or project stakeholders, depending on the nature of your request, to the extent necessary to assess the request and carry out pre-contractual or post-contractual processes;
-
legally authorised public institutions and organisations, and judicial or administrative authorities, for the purposes of complying with legal obligations and responding to duly submitted requests.
Where a service provider used by Ba’ndo is located abroad and personal data is consequently transferred outside Türkiye, the transfer will be carried out pursuant to Article 9 of the PDPL on the basis of an adequacy decision, one of the appropriate safeguards, or a relevant derogation applicable only to occasional cases that meet the conditions laid down in the Law. Regular and continuous transfers will not be based on derogations intended for occasional transfers.
6. Retention and Disposal
Your personal data is retained for as long as necessary for the relevant purpose of processing and for the limitation or retention periods prescribed by the legislation applicable to us. When determining the maximum retention period, we take into account the purpose of processing, legal obligations, dispute and evidentiary periods, and whether the data remains current. When the reasons requiring processing cease to exist, your personal data is erased, destroyed or anonymised ex officio or upon your request in accordance with Article 7 of the PDPL, the applicable Regulation, and the Company’s Personal Data Retention and Disposal Policy. Disposal activities and the periodic disposal schedule are recorded and implemented under that policy.
7. Process-Specific Privacy Notices
This General Privacy Notice does not replace detailed notices concerning specific processes. Individuals who apply for employment or an internship through “Join us” by e-mailing apply@wearebando.com will also receive the Candidate Privacy Notice; prospective clients or their representatives who contact newbiz.ldn@wearebando.com or newbiz.ist@wearebando.com through “Hire us” will also receive the Prospective Client and Business Development Privacy Notice, either through an automatic reply upon receipt of the e-mail or no later than the first communication. Where explicit consent is required, it will be obtained through a separate text and a separate declaration of intent, independently from the privacy notice.
8. Your Rights under the PDPL
Pursuant to Article 11 of the PDPL, you are entitled to apply to Ba’ndo and: (a) learn whether your personal data is processed; (b) request information if your personal data has been processed; (c) learn the purpose of processing your personal data and whether it is used in accordance with that purpose; (ç) know the third parties in Türkiye or abroad to whom your personal data has been transferred; (d) request the rectification of incomplete or inaccurate personal data; (e) request the erasure or destruction of your personal data under the conditions set out in Article 7; (f) request that the operations carried out under subparagraphs (d) and (e) be notified to third parties to whom your personal data has been transferred; (g) object to a result arising against you through the analysis of processed data exclusively by automated systems; and (ğ) claim compensation for damage arising from the unlawful processing of your personal data.
The application channels, mandatory application information and applicable procedures are explained in the PDPL Data Subject Application Form available in the PDPL section of the Site. Your application will be concluded free of charge as soon as possible and no later than thirty days, depending on the nature of the request; where the process entails an additional cost, the fee schedule determined by the Personal Data Protection Board may apply. For general questions about this Notice or the processing of your personal data, you may contact us at privacy@wearebando.com.
9. Updates to this Notice
This Notice may be updated if our personal data processing activities or the applicable legislation changes. The current version will apply prospectively from the date on which it is published on the Site. Material changes will also be announced by an appropriate and reasonable method where notification is legally required. Publication of this Notice does not in itself permit personal data previously collected for a different purpose to be processed for a new purpose; where the purpose changes, a further privacy notice will be provided before the new processing begins.